1. Field of the Invention
The present invention generally relates to packet switched network communications and, more particularly, a method for improving the performance efficiency of session layer proxies such as network firewalls and caching proxies for transmissions via communications networks, such as the Internet.
2. Background Description
The Internet is a collection of networks throughout the world which facilitates the sharing of resources among participating organizations, including government agencies, educational institutions and private corporations. These networks use the Transmission Control Protocol/Internet Protocol (TCP/IP) protocol suite and share a common address space. Thus, computers on the Internet use compatible communications standards and share the ability to contact each other and exchange data. Users of the Internet communicate mainly via electronic mail (e-mail), via http, the protocol for accessing the world wide web, via Telnet, a process that allows users to log in to a remote host, and via implementations of the File Transfer Protocol (FTP), a protocol that allows them to transfer information on a remote host to their local site.
Security is a major concern when connecting a network, such as a local area network (LAN) to the Internet. One of the more important concerns is intruders attempting to gain access to local hosts. A common method for preventing these types of intrusions is to install a so-called "firewall" which is a secure single point of attachment to the Internet. This single point of attachment takes the form of a firewall host which does not allow any traffic to pass through but allows both incoming and outgoing connections. In a typical firewall host implementation, a user wanting to transfer a file on a host in the LAN to an external host via the Internet first transfers the file to the firewall host and then logs into the firewall and transfer the file to the external host. While this procedure provides a high level of security for a single user, maintaining security as the number of users requiring access to this host becomes difficult. For general information on firewalls, see William R. Cheswick and Steven M. Bellovin, Firewalls and Internet Security, Addison-Wesley (1994).
A transport layer proxy architecture, called SOCKS, was created in an attempt to minimize security problems while allowing access by a large number of users. See, for example, David Koblas and Michelle R. Koblas, "SOCKS", UNIX Security Symposium, USENIX Association (199.sub.--), pp. 77-83, Ying-Da Lee, "SOCKS: A protocol for TCP proxy across firewalls", http://www.socks.nec.com/socks4.protocol, and M. Leech, M. Ganis, Y. Lee, R. Kuris, D. Koblas, and L. Jones, "SOCKS Protocol Version 5", ftp://ds.internic.net/rfc/rfc1928.txt. In a transport layer proxy architecture, one end system, which is called the client, initiates a session by making a connection to the proxy. The client and proxy use the connection to exchange messages negotiating session setup information such as authentication or proxy request (e.g., the foreign host to connect to a firewall proxy or the URL (Uniform Resource Locator) to fetch for an HTTP (Hypertext Transfer Protocol) proxy). The proxy then carries out the request, commonly opening a connection to another end-system outside the firewall, which is called the server, as directed by the client. The proxy may exchange session set information with the server over the connection. After session set up has been completed on both connections, the proxy begins to copy data back and forth between the two connections and does not delete from, add to, or alter the information flowing between the hosts (although it may silently keep a copy of the information, as in the case of HTTP caching proxies).
The currently used techniques of constructing a TCP proxy (e.g., a SOCKS server) involves splitting a TCP connection into two halves (client-to-proxy and proxy-to-server) and then using an application layer server to exchange data between the two ends. All known current transport layer proxies perform the data copying function in user space; i.e., a user process waits in a tight loop reading data from one socket and writing it to another one. Compared to the client or the server, the proxy spends twice as many CPU cycles on protocol processing, data copying, and context switching. What is needed is a way to effectively push data movement operation into kernel space to make the relay operation more efficient.